DNS 解析器之要求

DNS Resolver Requirements

The DNS resolver used by the Primary Network Perspective for all DNS queries associated with the validation of domain authorization or control and for CAA record lookups MUST:

主要網路視角（Primary Network Perspective）用於網域授權或控管權驗證相關的所有 DNS 查詢及 CAA 紀錄檢查之 DNS 解析器（DNS resolver），應（MUST）：

• perform DNSSEC validation using the algorithm defined in RFC 4035, Section 5; and

• 使用 RFC 4035 第 5 節 定義的演算法執行 DNSSEC 驗證；且

• support NSEC3 as defined in RFC 5155; and

• 支援 RFC 5155 定義的 NSEC3；且

• support SHA-2 as defined in RFC 4509 and RFC 5702; and

• 支援 RFC 4509 與 RFC 5702 定義的 SHA-2；且

• properly handle the security concerns enumerated in RFC 6840, Section 4.

• 妥善處理 RFC 6840 第 4 節 所列舉的安全疑慮。